Full transcript
0:00[Music]
0:14Thank you everyone for coming here. I
0:16hope you're uh excited to figure out
0:17with me what enterprise ready MCP means.
0:20Uh I'm not sure a month ago people even
0:23fully understood what MCP meant. Um so
0:26we're all on this journey together. Um,
0:28but hopefully it should be fun.
0:31So, I was chatting to a good friend and
0:33colleague who is is giving a talk
0:34tomorrow on building MCP servers and
0:36what it looks like to build that out.
0:38And his question was, how do the tools
0:40of today map to the AI systems of
0:42tomorrow? We already have some kind of
0:45not concept of enterprise ready tooling
0:47and building tools for the enterprise
0:49and production. What does it actually
0:50mean for MCP and something I kind of,
0:52you know, want to talk through today,
0:54chat with you guys. So for a long time
0:57from you know several years now we've
0:58had the model of you are a user you talk
1:00to an AI talk to a chatbot it does stuff
1:03the AIS had tool calling now they have
1:06MCP this is the MCP logo which is just a
1:08way of interfacing between the AI and an
1:11external resource of some kind to do
1:13something right can just be a database
1:15access it can be performing some
1:17complicated computation can be pulling
1:19in a prompt there's lots of stuff in the
1:20MCP spec that frankly you should go and
1:22read there's more there than most people
1:24realize
1:25We're also seeing workloads like this
1:27where an IT admin spins up an
1:29asynchronous workflow which is we're
1:32going to call an AI agent which
1:33automates some process that is you know
1:36kind of headless and is going and doing
1:37a thing we're trying to manage that that
1:39is then going to use MCP to access
1:41external tools that might be secured
1:43might be internal enterprise tools which
1:45introduce some fun problems. I also for
1:48the sake of this kind of diagram of what
1:50is the future going to look like want to
1:52introduce this line here just to throw
1:54some some spanners in the works of users
1:59in a company using their chatbot which
2:02makes a call to an MCP server which then
2:04goes and queries an AI workload an AI
2:06agent that's existing in the cloud
2:07performing some operation and so with
2:10this kind of diagram of what could
2:11happen I want us to figure out what we
2:14need to fix to make this really useful
2:16and production
2:17Okay, why am I why am I talking to you?
2:19I work for WorkOS, which is an
2:21enterprise security vendor, um, which
2:23I'll talk about in a second. I'm also a
2:25research fellow at Stanford working on
2:26safety for AI agents and just finished a
2:27PhD where I got to wear this really
2:29funny, silly hat, um, just a couple
2:31months ago. Um, OpenAI uh work OS is a
2:36enterprise security vendor that sells to
2:38all of the AI labs because the AI labs
2:40do not want to do the really painful
2:42annoying work to scale the security and
2:45orth operations into the enterprise. And
2:48so we've been thinking a lot about what
2:49it means to provide the glue that means
2:52people can build agents and then just
2:53seamlessly scale it and sell it to
2:55everyone. And so I want to just tell you
2:57all the answers today whether or not you
2:58want to use us. So let's go through the
3:01agent journey. We're all here trying to
3:02build agents. Um, let's tell a tell a
3:04story. So, I found this great API um
3:07that you can query and it will feed a
3:09bunch of goats that you can then see on
3:11a live stream. Um, this is a real API
3:14you can go and use. And so, naturally,
3:16you do what anyone would do and you're
3:17going to build an emotional support bot
3:19for employees at a company to build a
3:20SAS. Um, and you give it tool use to
3:23query this. Now, this is fine because
3:25it's a onetime query, but frankly, tool
3:28use kind of sucks. We've had it for
3:30years now. Not as many people are using
3:31it. It's really painful. A lot of things
3:33go wrong, which is why the model context
3:35protocol got invented. So why would you
3:37move to to MCP?
3:40One, there is this really robust
3:42ecosystem of tools and providers,
3:45security tooling that lets you interface
3:48between the model and the resource to
3:50make things safe and reliable. It's also
3:52really good at providing standardization
3:54to the models. the models are getting
3:55really good at learning how to use this
3:57either through RL or just kind of you
3:58know good eval usage. It also runs a
4:02stateful connection which means you can
4:04do you know better security better
4:06management better context management in
4:07the way you're passing in to an AM model
4:09and maybe you're doing it just because
4:10everyone's doing it and why not have
4:12some fun right it is genuinely quite fun
4:14to build an MCP server you can make cool
4:16things out of it so what do we do we
4:19make our local server right hopefully at
4:21some point everyone's had a little play
4:23with this uh you tweet out check out my
4:25local host um you know try and get your
4:27friends to play with it it's great it's
4:29hacky it's not particularly useful to
4:31anyone except yourself. You can build
4:33some fun local service. Frankly, this is
4:35where we see a lot of people building
4:37MCP right now. It's an internal demo.
4:39You're going to see if you can connect
4:40it to an API. Cool. It works. And then
4:43we don't go much further than that.
4:46And so kind of the next step where
4:48everyone has been talking about a lot of
4:49discussion in the community, how do we
4:50do this really robustly is just adding
4:52authentication, authorization to these
4:54workloads, which is truthfully right now
4:58the main thing you need to do. These are
4:59links to docs that will help you do it.
5:01Uh through there you can come and chat
5:03with me and I will sit down with you
5:04anywhere in the world and help you build
5:06a really robust secure MCP server and
5:08figure out some pain points. Um you
5:11should not have an external API that is
5:15unauthenticated that has no access
5:17controls on it. Uh things will go very
5:20wrong. So super simple you make people
5:22log in. You scope you have an admin
5:24privilege so that no one is feeding the
5:26goats too much. you know, make sure
5:28goats are well maintained and kept safe.
5:30Um, and maybe if you're doing this
5:32internally with an organization, you put
5:33in a VPC, you're doing that gateway to
5:35make sure no one can access they should,
5:37but everyone turns out in your
5:38organization loves your goat emotional
5:41support tool because who wouldn't? And
5:44so you do what what anyone would do. You
5:45you say, "Let's make it public. Let's
5:47make a public MCP server that people can
5:49add to their claude, that people can
5:51build applications on top of. Let's add
5:52a stripe in there to make sure they've
5:54got payment rails. just sends back a URL
5:56that you can call out to click things.
5:57It's pretty straightforward. Um, you
5:59give some users free credits because,
6:00you know, this is how apps work. Uh, and
6:02you put it on a cloud hosting solution.
6:04Tons and tons of them are spinning up.
6:06You get ads and announcements about them
6:08every day. Fundamentally, MCP servers
6:10are just a normal workload, which means
6:12a lot of the cloud hosting providers can
6:14support whatever you need to host. And
6:17so there's there's lots and lots that we
6:18can discuss there. But you do this
6:20really well, and everyone loves goat
6:22feeding and emotional support. So, you
6:25end up going viral. You've got a
6:27billboard on the highway. Mr. Beast
6:29tweets you out. What happens now? You
6:32end up with having way too much
6:34traction, right? You get free credit
6:36abuse on the signups. Uh, this is
6:38something that we see a ton of AI
6:39companies that we support happening is
6:42AI companies give you some free credits
6:43to onboard you, but at the end of the
6:45day, they're just querying an AI API,
6:48which means that folks will sign up for
6:50an account, abuse those free credits,
6:52and cycle back. one of the AI vendors uh
6:54that we work with, someone was using
6:57their free credits to write fanfiction
6:59stories um by just this is not an
7:01application designed for writing
7:02fanfiction just because it's a
7:05convenient way to get free credits and
7:06so you end up needing bot blocking on
7:08signups. Um you need kind of robust
7:11controls over the whole orth stack to
7:12make sure nothing goes wrong. Uh you're
7:15going to end up needing uh input
7:16validation so that no one prompt
7:18injection attacks your goats. Got to
7:19keep them safe. Uh and then there's a
7:21lot of niche stuff that happens with
7:23MCP. So, uh MCP servers dynamically
7:26register their clients with the server,
7:29which means if you have any developer
7:31admin dashboard, application dashboard
7:33that's tracking the applications that
7:35you've created, they will suddenly be
7:37flooded with MCP servers because of this
7:39weird choice in how MCP servers register
7:42as applications. And so essentially
7:45every orth stack you need, every like
7:47management tooling you need needs to be
7:49adapted for MCP. And so this is
7:51something that we provide but also like
7:53a bunch of other people are working on
7:54and something to be conscious of is if
7:56you scale things will start going very
7:57wrong.
7:59And so everyone loves your MCP server
8:01that's super cool. Maybe it's just an AI
8:02AI agent wrapping it or you're selling
8:04the core MCP server. You want to sell
8:06into enterprise. What do we have to do?
8:08This is like a well-worn SAS path that
8:10we're going to go through. You have to
8:12do all of the boring stuff. You have to
8:14do the SSO, the life cycle management.
8:16You're going to have to do provisioning.
8:18Um, Block uh are this super cool company
8:22um that developed Goose. And internally,
8:25they've been provisioning AI like access
8:28to this client, this chat client as well
8:30as MCP servers. And I really see a
8:32future where enterprises use SSO to
8:35provision access to a ton of internal
8:38resources exposed via MCP that then
8:40employees can chat with as a you know
8:42default way that employees are
8:44encouraged to use AI to automate
8:45workflows.
8:47And so if you're going to sell into the
8:48enterprise, you end up needing all this
8:49like nitty-gritty stuff that really
8:51sucks. Fine grand access controls that
8:52are highly performant are really robust
8:54audit logs um for instant responses. A
8:57lot of the regulations that exist right
8:59now like GDPR um call out explicitly
9:02additional requirements on logging for
9:04AI workloads because the regulators like
9:07to regulate and so your audit logs that
9:10exist normally have to fit a very
9:12specific set of requirements which are
9:13not well supported widely and so
9:16something to think about as you scale
9:17these workloads. Um and you need stuff
9:19like data loss preventions so that
9:20people aren't like uploading random
9:21things to MCP servers. This becomes a
9:24significant risk when people are just
9:25chatting wildly with a ton of servers.
9:28And so now you have an enterprise ready
9:31serverish
9:34because there are a lot of other
9:35questions to answer. This this is a talk
9:37that was was hidden to tell you the
9:38answers, but truthfully the answers
9:40aren't entirely known yet and the
9:41protocol is very rapidly developing.
9:44And so this is the the diagram we
9:46started off with. This stuff's super
9:48easy, right? How does a user log into an
9:51AI chat? Done. We've solved that. How do
9:54AI systems connect to MCP servers? This
9:57is something that's being worked on.
9:58It's pretty straightforward. We can do
9:59all there. You can scan those QR codes
10:01from before, build it, and you have a
10:03production ready MCP server. MCP servers
10:06connecting to external resources is
10:08pretty straightforward. It's not too
10:10hard to do. Can be a bit annoying, but
10:11you know, you have to pass your scopes
10:12and do it properly. Um, IT admins
10:16managing AI workloads pretty
10:18straightforward. And in theory, you
10:21know, the other end of MCP servers
10:23existing in your tenency connecting to
10:25resources, bit of a pain point, but can
10:26easily be built. There are lots of open
10:29questions still as to how we do this.
10:31Um, how exactly remote asynchronous
10:33workloads can do headless or off into
10:36MCP servers with dynamic client
10:39registration uh and make sure that is
10:41you have correct authorization controls.
10:43It's actually super hard and things keep
10:46going wrong along the way. um how these
10:48asynchronous workloads call out to
10:50relevant users. Uh there is a a new RFC
10:54in the MCP spec for elicitation. So when
10:58your model doesn't know what to do, it
11:01knows that it should ask a human being
11:03and this is becoming supported as part
11:04of MCP that it can go and call out
11:06towards a user um and say please provide
11:09additional input that you need because
11:11I'm missing details. So stuff like this
11:13is actively developing and nothing is
11:14stable. Um and then there's this very
11:18broad question that we're running into
11:19with AI workloads um of uh passing scope
11:24between different AI workloads passing
11:26access control between AI workloads
11:28where if you have the A2 we're talking
11:30about MCP if you're using A2A protocol
11:33you are just telling an agent mostly in
11:36vibes what it should or shouldn't do and
11:39relying upon the alignment of that model
11:41to make sure it doesn't misbehave and so
11:44actually passing robust authorization
11:46you know scopes uh communicating access
11:49controls making sure that service
11:50account that AI workload might be has
11:52the correct access turns out to be a
11:54huge pain point in doing this. So
11:57frankly the cloud vendors are mostly
11:58solving the cloud hosting. I think the
12:00authorization and access control element
12:02of this is the hardest part of putting
12:04this into external enterprise workloads
12:07um and a big thing that needs to be
12:08filled.
12:10So
12:12if you want to build fun things, we are
12:14actively building out this entire stack
12:16to sell to AI companies and startups. Uh
12:19and if you go to the docs, we can build
12:21some cool stuff together. Um everyone is
12:23building interesting things right now.
12:24And you know, it's fun to get into the
12:25nitty-gritty and and see what bugs
12:27occur. And then as a thank you for all
12:30listening to this fun talk, uh you
12:32cannot use this on your phones. To be
12:34clear, you can buy this shirt only
12:36through MCP.
12:39Uh the instructions are on the website.
12:41Uh very briefly, if you'd like to see,
12:43let me see if I can get out of this um
12:45and go to cursor. You have to add the
12:49MCP server. There are many ways to do
12:50this, but the way I'd recommend is just
12:52going into one of your AI um editors, uh
12:55typing in the JSON that the website will
12:57give you. This is like the easiest way
12:58to add. You'll see that it's turned on.
13:00You'll need to make an account because
13:01authorization, access control, etc. Um
13:04and then you can say, "Please buy me a
13:07shirt.
13:09Um, and of course the Wi-Fi um will not
13:12work.
13:15Beautiful. Will need my mailing address.
13:17One, two, three. Hack away. Um, work OS.
13:21And I want a medium.
13:24And it knows my name. It's authorized.
13:27It's done a validation check on me.
13:28We've got a bot blocker on the signup so
13:30that people can't abuse my shirts. And
13:32you'll see right there that we purchased
13:34a shirt. So, let's go back to Keynote.
13:38um scan it, add it to your computer if
13:40you want. Um and you guys can have a
13:42free very nice MCP shirt uh that I would
13:45love to share around. Thank you very
13:46much.
13:51[Music]